Part 4 / 6

CDR and IPDR Analysis

🕑 90-120 minutes 📖 Intermediate Level 📋 Module 3

Introduction

CDR (Call Detail Record) and IPDR (Internet Protocol Detail Record) are the most important evidence in cyber crime investigation. These records help in identifying who communicated with whom, when, and from where. This section will explain in detail how to obtain and analyze these records.

📚 Learning Objectives

After this part, you will be able to understand what CDR is and how to obtain it, analyze CDR fields, perform IPDR analysis, and do tower location mapping to track suspects.

What is CDR?

CDR (Call Detail Record) is a detailed record of all voice calls and SMS generated by a telecom service provider for each subscriber. It contains information about every call - who called whom, when, for how long, and from which tower.

Types of CDR

📞

Voice CDR

Record of all incoming and outgoing voice calls. Contains caller, called number, duration, and tower information.

💬

SMS CDR

Record of sent and received SMS. Contains sender, receiver number, timestamp, and tower information.

🌐

Data CDR

Record of mobile data usage. Contains data volume, session duration, and tower information.

📱

Tower Dump

List of all mobile numbers that connected to a specific tower during a time period.

How to Obtain CDR

CDR is obtained from telecom service providers through legal process:

  1. Section 91 CrPC (BNSS Section 94): Court can issue summons to telecom company
  2. Section 92 CrPC (BNSS Section 95): For urgent cases, SP or above can requisition
  3. Direct Request: Many TSPs have nodal officers who handle law enforcement requests
CDR Retention Period

As per DoT guidelines, telecom companies must retain CDR for at least 2 years. IPDR retention period is 1 year. Ensure timely requests as data may be purged after retention period.

Understanding CDR Fields

It is important to understand CDR fields for effective analysis. Different telecom companies may have slightly different formats, but the basic fields remain the same.

Important CDR Fields

Calling Number / A-Party
The mobile number that initiated the call or sent the SMS.
Called Number / B-Party
The mobile number that received the call or SMS.
Date and Time
Exact timestamp of the call/SMS. Usually in IST format.
Duration
Call duration in seconds. For SMS, this field is 0 or null.
Call Type
MOC (Mobile Originated Call), MTC (Mobile Terminated Call), SMS-MO, SMS-MT
IMEI
International Mobile Equipment Identity - 15-digit unique device identifier.
IMSI
International Mobile Subscriber Identity - Unique SIM card identifier.
Cell ID / CGI
Cell Global Identity - Unique identifier of the cell tower. Format: MCC-MNC-LAC-CI
First Cell ID
Tower to which the phone was connected at the start of the call.
Last Cell ID
Tower to which the phone was connected at the end of the call (if handover occurred).

Sample CDR Format

Date,Time,A_Number,B_Number,Duration,Call_Type,IMEI,First_Cell_ID,Last_Cell_ID 15-01-2024,10:30:45,9876543210,9123456789,180,MOC,353456789012345,404-86-1234-5678,404-86-1234-5679 15-01-2024,10:35:12,9123456789,9876543210,0,SMS-MT,353456789012345,404-86-1234-5680, 15-01-2024,11:00:00,9876543210,9988776655,300,MOC,353456789012345,404-86-1234-5681,404-86-1234-5681

CDR Analysis Techniques

Basic Analysis Steps

  1. Data Cleaning: Remove duplicate entries, fix formatting issues
  2. Timeline Analysis: Arrange calls chronologically to understand activity pattern
  3. Contact Analysis: Identify frequent contacts and their relationship
  4. Location Analysis: Map cell IDs to physical locations
  5. Pattern Analysis: Identify unusual patterns or anomalies

Key Analysis Points

Analysis TypePurposeMethod
Common Number AnalysisIdentify numbers that communicate with both suspectsCross-reference CDRs of multiple suspects
Tower AnalysisEstablish location at specific timeMap cell IDs to tower locations
Call PatternIdentify unusual call patternsLook for bursts of activity, odd hours
IMEI TrackingTrack device even if SIM changedRequest CDR by IMEI instead of number
Tower Dump AnalysisIdentify all phones at crime sceneRequest dump from nearest towers
💡 Practical Example

If a crime occurred at 10:00 PM, request CDR with tower dump of nearby towers for 9:30 PM to 10:30 PM. This will give you a list of all mobile phones that were in the area during that time. Cross-reference with suspect's known numbers.

IPDR Analysis

IPDR (Internet Protocol Detail Record) is a record of internet data sessions. It contains information about when a user connected to the internet, what IP address was assigned, and how much data was used.

IPDR Fields

FieldDescription
User ID / MSISDNMobile number or subscriber identifier
Session Start TimeWhen the data session started
Session End TimeWhen the data session ended
Private IPIP assigned to the device by the carrier
Public IP / NAT IPIP address visible to external servers
Port NumberNAT port used for the session
APNAccess Point Name (internet, mms, etc.)
Data VolumeUpload and download bytes
Cell IDTower information during the session
IMEIDevice identifier

IPDR Use Cases

  • IP to Subscriber Mapping: Identify who was using a specific IP address at a specific time
  • Session Correlation: Link online activities to specific subscriber
  • Location Tracking: Cell ID in IPDR helps establish location during internet usage
  • Data Usage Patterns: Identify unusual data consumption patterns
NAT and Multiple Users

Most mobile carriers use CGNAT (Carrier Grade NAT), meaning multiple subscribers may share the same public IP. Always request both IP address AND port number with exact timestamp to identify the correct subscriber.

Tower Location Mapping

Tower location mapping is the process of converting Cell IDs to physical geographic locations. This is crucial for establishing the location of a suspect at a specific time.

Cell ID Format

Cell Global Identity (CGI) Format: MCC-MNC-LAC-CI Example: 404-86-1234-5678 - MCC (Mobile Country Code): 404 = India - MNC (Mobile Network Code): 86 = Vodafone-Idea - LAC (Location Area Code): 1234 - CI (Cell Identity): 5678

MNC Codes for Major Indian Operators

MNCOperator
10, 72, 88Airtel
11, 21, 27, 46, 86Vodafone-Idea
56, 66BSNL
04, 05, 34, 38, 54MTNL
06Jio

Getting Tower Locations

  • From TSP: Request tower location data along with CDR
  • CellID Databases: Online databases like OpenCellID, CellMapper
  • TSP Nodal Officer: Can provide exact coordinates for Cell IDs
  • Tower Dump: Includes tower location details

Mapping Tools

  • Google Earth: Plot tower locations and create visual maps
  • QGIS: Open source GIS software for detailed mapping
  • Excel with Maps: Basic mapping using Excel add-ins
  • Specialized Software: Cellebrite, UFED Physical Analyzer
💡 Tower Coverage Area

A cell tower's coverage area varies:
- Urban areas: 500m to 1km radius
- Suburban areas: 1-3km radius
- Rural areas: Up to 10km radius
Tower data provides approximate location, not exact GPS coordinates.

Practical Investigation Steps

Step-by-Step CDR Investigation

  1. Identify Target Numbers: Collect all phone numbers related to the case
  2. Request CDR: Send formal request to TSP with proper legal authorization
  3. Request Tower Details: Ask for tower location data for all Cell IDs
  4. Import Data: Load CDR into analysis software (Excel, i2 Analyst, etc.)
  5. Clean Data: Remove duplicates, standardize formats
  6. Timeline Analysis: Create chronological timeline of all communications
  7. Contact Network: Map all contacts and their relationships
  8. Location Analysis: Plot movements using tower data
  9. Identify Patterns: Look for unusual patterns or correlations
  10. Corroborate: Cross-reference with other evidence
Important Considerations

- CDR does not prove content of conversation, only that communication occurred
- Tower location is approximate, not exact GPS
- IMEI can be cloned or spoofed in some cases
- Always corroborate CDR evidence with other evidence types

📚 Key Points
  • CDR contains detailed records of all voice calls and SMS with tower information
  • IPDR records internet sessions and is crucial for tracing online activities to subscribers
  • Key CDR fields include A-party, B-party, timestamp, duration, IMEI, IMSI, and Cell ID
  • Tower dump provides list of all devices connected to a tower during specific time
  • Cell ID format is MCC-MNC-LAC-CI and helps identify operator and location
  • NAT means multiple subscribers may share same IP - always request IP + Port + Timestamp
  • CDR retention is 2 years, IPDR retention is 1 year - request data timely
  • Tower data provides approximate location, not exact GPS coordinates